# CVE-2022-4304: libssl3t64: A timing based side channel exists in the OpenSSL RSA Decryptionimplementationwhich could be sufficient to recover a...

CVE-2022-4304 is fixed in 22 products on 1 platform, first by libnode72 12.22.9~dfsg-1ubuntu3.3, released February 6, 2023. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2022-4304
- Priority: High
- CVSS: 7.5 (Medium)
- EPSS: 0.2351
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Feb 6, 2023

## Description

A timing based side channel exists in the OpenSSL RSA Decryptionimplementationwhich could be sufficient to recover a plaintext across a network in aBleichenbacher style attack. To achieve a successful decryption an attackerwould have to be able to send a very large number of trial messages fordecryption. The vulnerability affects all RSA padding modes: PKCS#1 v1.5,RSA-OEAP and RSASVE.For example, in a TLS connection, RSA is commonly used by a client to sendanencrypted pre-master secret to the server. An attacker that had observed agenuine connection between a client and a server could use this flaw tosendtrial messages to the server and record the time taken to process them.After asufficiently large number of messages the attacker could recover thepre-mastersecret used for the original connection and thus be able to decrypt theapplication data sent over that connection.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | edk2-aarch64 RHEL 8 | 0:20220126gitbb1bba3d77-4.el8 | [RHSA-2023:2932](https://patchblox.com/security/data/fix/linux/rhsa-2023-2932.md) | May 16, 2023 |
| Linux | edk2-aarch64 RHEL 9 | 0:20221207gitfff6d81270b5-9.el9_2 | [RHSA-2023:2165](https://patchblox.com/security/data/fix/linux/rhsa-2023-2165.md) | May 9, 2023 |
| Linux | edk2-aarch64 almalinux 8 | 20220126gitbb1bba3d77-4.el8 | [ALSA-2023:2932](https://patchblox.com/security/data/fix/linux/alsa-2023-2932.md) | May 16, 2023 |
| Linux | edk2-aarch64 almalinux 9 | 20221207gitfff6d81270b5-9.el9_2 | [ALSA-2023:2165](https://patchblox.com/security/data/fix/linux/alsa-2023-2165.md) | May 9, 2023 |
| Linux | edk2-aarch64 ol 8 | 1:20230821-1.el8 | [ELSA-2023-13025](https://patchblox.com/security/data/fix/linux/elsa-2023-13025.md) | Dec 6, 2023 |
| Linux | edk2-aarch64 ol 9 | 0:20221207gitfff6d81270b5-9.el9_2 | [ELSA-2023-2165](https://patchblox.com/security/data/fix/linux/elsa-2023-2165.md) | May 15, 2023 |
| Linux | edk2-ovmf RHEL 8 | 0:20220126gitbb1bba3d77-4.el8 | [RHSA-2023:2932](https://patchblox.com/security/data/fix/linux/rhsa-2023-2932.md) | May 16, 2023 |
| Linux | edk2-ovmf RHEL 9 | 0:20221207gitfff6d81270b5-9.el9_2 | [RHSA-2023:2165](https://patchblox.com/security/data/fix/linux/rhsa-2023-2165.md) | May 9, 2023 |
| Linux | edk2-ovmf almalinux 8 | 20220126gitbb1bba3d77-4.el8 | [ALSA-2023:2932](https://patchblox.com/security/data/fix/linux/alsa-2023-2932.md) | May 16, 2023 |
| Linux | edk2-ovmf almalinux 9 | 20221207gitfff6d81270b5-9.el9_2 | [ALSA-2023:2165](https://patchblox.com/security/data/fix/linux/alsa-2023-2165.md) | May 9, 2023 |
| Linux | edk2-ovmf ol 8 | 1:20230821-1.el8 | [ELSA-2023-13025](https://patchblox.com/security/data/fix/linux/elsa-2023-13025.md) | Dec 6, 2023 |
| Linux | edk2-ovmf ol 9 | 0:20221207gitfff6d81270b5-9.el9_2 | [ELSA-2023-2165](https://patchblox.com/security/data/fix/linux/elsa-2023-2165.md) | May 15, 2023 |
| Linux | edk2-tools RHEL 9 | 0:20221207gitfff6d81270b5-9.el9_2 | [RHSA-2023:2165](https://patchblox.com/security/data/fix/linux/rhsa-2023-2165.md) | May 9, 2023 |
| Linux | edk2-tools almalinux 9 | 20221207gitfff6d81270b5-9.el9_2 | [ALSA-2023:2165](https://patchblox.com/security/data/fix/linux/alsa-2023-2165.md) | May 9, 2023 |
| Linux | edk2-tools ol 8 | 1:20230821-1.el8 | [ELSA-2023-32791](https://patchblox.com/security/data/fix/linux/elsa-2023-32791.md) | Dec 6, 2023 |
| Linux | edk2-tools ol 9 | 0:20221207gitfff6d81270b5-9.el9_2 | [ELSA-2023-2165](https://patchblox.com/security/data/fix/linux/elsa-2023-2165.md) | May 15, 2023 |
| Linux | edk2-tools-doc RHEL 9 | 0:20221207gitfff6d81270b5-9.el9_2 | [RHSA-2023:2165](https://patchblox.com/security/data/fix/linux/rhsa-2023-2165.md) | May 9, 2023 |
| Linux | edk2-tools-doc almalinux 9 | 20221207gitfff6d81270b5-9.el9_2 | [ALSA-2023:2165](https://patchblox.com/security/data/fix/linux/alsa-2023-2165.md) | May 9, 2023 |
| Linux | edk2-tools-doc ol 9 | 0:20221207gitfff6d81270b5-9.el9_2 | [ELSA-2023-2165](https://patchblox.com/security/data/fix/linux/elsa-2023-2165.md) | May 15, 2023 |
| Linux | libnode72 Ubuntu 22.04.1 LTS (jammy) | 12.22.9~dfsg-1ubuntu3.3 | [libnode72 12.22.9~dfsg-1ubuntu3.3](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-libnode72-12.22.9-dfsg-1ubuntu3.3.md) | Feb 6, 2023 |
| Linux | libssl1.1 Ubuntu 18.04.6 LTS (bionic) | 1.1.1-1ubuntu2.1~18.04.21 | [libssl1.1 1.1.1-1ubuntu2.1~18.04.21](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-libssl1.1-1.1.1-1ubuntu2.1-18.04.21.md) | Feb 6, 2023 |
| Linux | libssl1.1 Ubuntu 20.04 LTS (focal) | 1.1.1f-1ubuntu2.17 | [libssl1.1 1.1.1f-1ubuntu2.17](https://patchblox.com/security/data/fix/linux/ubuntu-focal-libssl1.1-1.1.1f-1ubuntu2.17.md) | Feb 6, 2023 |
| Linux | libssl3 Ubuntu 22.04.1 LTS (jammy) | 3.0.2-0ubuntu1.8 | [libssl3 3.0.2-0ubuntu1.8](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-libssl3-3.0.2-0ubuntu1.8.md) | Feb 6, 2023 |
| Linux | libssl3t64 Ubuntu 24.10 (oracular) | 3.0.8-1ubuntu1 | [libssl3t64 3.0.8-1ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-oracular-libssl3t64-3.0.8-1ubuntu1.md) | Feb 7, 2023 |
| Linux | libssl3t64 Ubuntu 25.04 (plucky) | 3.0.8-1ubuntu1 | [libssl3t64 3.0.8-1ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-plucky-libssl3t64-3.0.8-1ubuntu1.md) | Feb 7, 2023 |
| Linux | nodejs Ubuntu 22.04.1 LTS (jammy) | 12.22.9~dfsg-1ubuntu3.3 | [nodejs 12.22.9~dfsg-1ubuntu3.3](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-nodejs-12.22.9-dfsg-1ubuntu3.3.md) | Feb 6, 2023 |
| Linux | openssl Debian 12.15 (bookworm) | 3.0.8-1 | [DEBIAN-CVE-2022-4304](https://patchblox.com/security/data/fix/linux/debian-cve-2022-4304.md) | Feb 8, 2023 |
| Linux | openssl Debian 13.5 (trixie) | 3.0.8-1 | [DEBIAN-CVE-2022-4304](https://patchblox.com/security/data/fix/linux/debian-cve-2022-4304.md) | Feb 8, 2023 |
| Linux | openssl Debian 14 | 3.0.8-1 | [DEBIAN-CVE-2022-4304](https://patchblox.com/security/data/fix/linux/debian-cve-2022-4304.md) | Feb 8, 2023 |
| Linux | openssl RHEL 8 | 1:1.1.1k-9.el8_7 | [RHSA-2023:1405](https://patchblox.com/security/data/fix/linux/rhsa-2023-1405.md) | Mar 22, 2023 |
| Linux | openssl RHEL 9 | 1:3.0.1-47.el9_1 | [RHSA-2023:0946](https://patchblox.com/security/data/fix/linux/rhsa-2023-0946.md) | Feb 28, 2023 |
| Linux | openssl Ubuntu 18.04.6 LTS (bionic) | 1.1.1-1ubuntu2.1~18.04.21 | [openssl 1.1.1-1ubuntu2.1~18.04.21](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-openssl-1.1.1-1ubuntu2.1-18.04.21.md) | Feb 6, 2023 |
| Linux | openssl Ubuntu 20.04 LTS (focal) | 1.1.1f-1ubuntu2.17 | [openssl 1.1.1f-1ubuntu2.17](https://patchblox.com/security/data/fix/linux/ubuntu-focal-openssl-1.1.1f-1ubuntu2.17.md) | Feb 6, 2023 |
| Linux | openssl Ubuntu 22.04.1 LTS (jammy) | 3.0.2-0ubuntu1.8 | [openssl 3.0.2-0ubuntu1.8](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-openssl-3.0.2-0ubuntu1.8.md) | Feb 6, 2023 |
| Linux | openssl Ubuntu 24.10 (oracular) | 3.0.8-1ubuntu1 | [openssl 3.0.8-1ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-oracular-openssl-3.0.8-1ubuntu1.md) | Feb 7, 2023 |
| Linux | openssl Ubuntu 25.04 (plucky) | 3.0.8-1ubuntu1 | [openssl 3.0.8-1ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-plucky-openssl-3.0.8-1ubuntu1.md) | Feb 7, 2023 |
| Linux | openssl almalinux 8 | 1:1.1.1k-9.el8_7 | [ALSA-2023:1405](https://patchblox.com/security/data/fix/linux/alsa-2023-1405.md) | Mar 22, 2023 |
| Linux | openssl almalinux 9 | 1:3.0.1-47.el9_1 | [ALSA-2023:0946](https://patchblox.com/security/data/fix/linux/alsa-2023-0946.md) | Feb 28, 2023 |
| Linux | openssl amzn 2023 | 1:3.0.5-1.amzn2023.0.6 | [ALAS2023-2023-101](https://patchblox.com/security/data/fix/linux/alas2023-2023-101.md) | Feb 17, 2023 |
| Linux | openssl ol 8 | 2:1.1.1k-9.ksplice1.el8_7 | [ELSA-2023-12213](https://patchblox.com/security/data/fix/linux/elsa-2023-12213.md) | Mar 28, 2023 |
| Linux | openssl ol 9 | 1:3.0.1-47.0.1.el9_1 | [ELSA-2023-0946](https://patchblox.com/security/data/fix/linux/elsa-2023-0946.md) | Feb 28, 2023 |
| Linux | openssl rocky 8 | 1:1.1.1k-9.el8_7 | [RLSA-2023:1405](https://patchblox.com/security/data/fix/linux/rlsa-2023-1405.md) | Mar 28, 2023 |
| Linux | openssl rocky 9 | 1:3.0.1-47.el9_1 | [RLSA-2023:0946](https://patchblox.com/security/data/fix/linux/rlsa-2023-0946.md) | Mar 29, 2023 |
| Linux | openssl-debuginfo amzn 2023 | 1:3.0.5-1.amzn2023.0.6 | [ALAS2023-2023-101](https://patchblox.com/security/data/fix/linux/alas2023-2023-101.md) | Feb 17, 2023 |
| Linux | openssl-debugsource amzn 2023 | 1:3.0.5-1.amzn2023.0.6 | [ALAS2023-2023-101](https://patchblox.com/security/data/fix/linux/alas2023-2023-101.md) | Feb 17, 2023 |
| Linux | openssl-debugsource ol 8 | 2:1.1.1k-9.ksplice1.el8_7 | [ELSA-2023-12213](https://patchblox.com/security/data/fix/linux/elsa-2023-12213.md) | Mar 28, 2023 |
| Linux | openssl-devel RHEL 8 | 1:1.1.1k-9.el8_7 | [RHSA-2023:1405](https://patchblox.com/security/data/fix/linux/rhsa-2023-1405.md) | Mar 22, 2023 |
| Linux | openssl-devel RHEL 9 | 1:3.0.1-47.el9_1 | [RHSA-2023:0946](https://patchblox.com/security/data/fix/linux/rhsa-2023-0946.md) | Feb 28, 2023 |
| Linux | openssl-devel almalinux 8 | 1:1.1.1k-9.el8_7 | [ALSA-2023:1405](https://patchblox.com/security/data/fix/linux/alsa-2023-1405.md) | Mar 22, 2023 |
| Linux | openssl-devel almalinux 9 | 1:3.0.1-47.el9_1 | [ALSA-2023:0946](https://patchblox.com/security/data/fix/linux/alsa-2023-0946.md) | Feb 28, 2023 |
| Linux | openssl-devel amzn 2023 | 1:3.0.5-1.amzn2023.0.6 | [ALAS2023-2023-101](https://patchblox.com/security/data/fix/linux/alas2023-2023-101.md) | Feb 17, 2023 |
| Linux | openssl-devel ol 8 | 2:1.1.1k-9.ksplice1.el8_7 | [ELSA-2023-12213](https://patchblox.com/security/data/fix/linux/elsa-2023-12213.md) | Mar 28, 2023 |
| Linux | openssl-devel ol 9 | 1:3.0.1-47.0.1.el9_1 | [ELSA-2023-0946](https://patchblox.com/security/data/fix/linux/elsa-2023-0946.md) | Feb 28, 2023 |
| Linux | openssl-libs RHEL 8 | 1:1.1.1k-9.el8_7 | [RHSA-2023:1405](https://patchblox.com/security/data/fix/linux/rhsa-2023-1405.md) | Mar 22, 2023 |
| Linux | openssl-libs RHEL 9 | 1:3.0.1-47.el9_1 | [RHSA-2023:0946](https://patchblox.com/security/data/fix/linux/rhsa-2023-0946.md) | Feb 28, 2023 |
| Linux | openssl-libs almalinux 8 | 1:1.1.1k-9.el8_7 | [ALSA-2023:1405](https://patchblox.com/security/data/fix/linux/alsa-2023-1405.md) | Mar 22, 2023 |
| Linux | openssl-libs almalinux 9 | 1:3.0.1-47.el9_1 | [ALSA-2023:0946](https://patchblox.com/security/data/fix/linux/alsa-2023-0946.md) | Feb 28, 2023 |
| Linux | openssl-libs amzn 2023 | 1:3.0.5-1.amzn2023.0.6 | [ALAS2023-2023-101](https://patchblox.com/security/data/fix/linux/alas2023-2023-101.md) | Feb 17, 2023 |
| Linux | openssl-libs ol 8 | 2:1.1.1k-9.ksplice1.el8_7 | [ELSA-2023-12213](https://patchblox.com/security/data/fix/linux/elsa-2023-12213.md) | Mar 28, 2023 |
| Linux | openssl-libs ol 9 | 1:3.0.1-47.0.1.el9_1 | [ELSA-2023-0946](https://patchblox.com/security/data/fix/linux/elsa-2023-0946.md) | Feb 28, 2023 |
| Linux | openssl-libs-debuginfo amzn 2023 | 1:3.0.5-1.amzn2023.0.6 | [ALAS2023-2023-101](https://patchblox.com/security/data/fix/linux/alas2023-2023-101.md) | Feb 17, 2023 |
| Linux | openssl-perl RHEL 8 | 1:1.1.1k-9.el8_7 | [RHSA-2023:1405](https://patchblox.com/security/data/fix/linux/rhsa-2023-1405.md) | Mar 22, 2023 |
| Linux | openssl-perl RHEL 9 | 1:3.0.1-47.el9_1 | [RHSA-2023:0946](https://patchblox.com/security/data/fix/linux/rhsa-2023-0946.md) | Feb 28, 2023 |
| Linux | openssl-perl almalinux 8 | 1:1.1.1k-9.el8_7 | [ALSA-2023:1405](https://patchblox.com/security/data/fix/linux/alsa-2023-1405.md) | Mar 22, 2023 |
| Linux | openssl-perl almalinux 9 | 1:3.0.1-47.el9_1 | [ALSA-2023:0946](https://patchblox.com/security/data/fix/linux/alsa-2023-0946.md) | Feb 28, 2023 |
| Linux | openssl-perl amzn 2023 | 1:3.0.5-1.amzn2023.0.6 | [ALAS2023-2023-101](https://patchblox.com/security/data/fix/linux/alas2023-2023-101.md) | Feb 17, 2023 |
| Linux | openssl-perl ol 8 | 2:1.1.1k-9.ksplice1.el8_7 | [ELSA-2023-12213](https://patchblox.com/security/data/fix/linux/elsa-2023-12213.md) | Mar 28, 2023 |
| Linux | openssl-perl ol 9 | 1:3.0.1-47.0.1.el9_1 | [ELSA-2023-0946](https://patchblox.com/security/data/fix/linux/elsa-2023-0946.md) | Feb 28, 2023 |
| Linux | openssl-static ol 8 | 2:1.1.1k-9.ksplice1.el8_7 | [ELSA-2023-12213](https://patchblox.com/security/data/fix/linux/elsa-2023-12213.md) | Mar 28, 2023 |
| Linux | ovmf Ubuntu 22.04.1 LTS (jammy) | 2022.02-3ubuntu0.22.04.4 | [ovmf 2022.02-3ubuntu0.22.04.4](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-ovmf-2022.02-3ubuntu0.22.04.4.md) | Aug 12, 2025 |
| Linux | ovmf-ia32 Ubuntu 22.04.1 LTS (jammy) | 2022.02-3ubuntu0.22.04.4 | [ovmf-ia32 2022.02-3ubuntu0.22.04.4](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-ovmf-ia32-2022.02-3ubuntu0.22.04.4.md) | Aug 12, 2025 |
| Linux | qemu-efi Ubuntu 22.04.1 LTS (jammy) | 2022.02-3ubuntu0.22.04.4 | [qemu-efi 2022.02-3ubuntu0.22.04.4](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-qemu-efi-2022.02-3ubuntu0.22.04.4.md) | Aug 12, 2025 |
| Linux | qemu-efi-aarch64 Ubuntu 22.04.1 LTS (jammy) | 2022.02-3ubuntu0.22.04.4 | [qemu-efi-aarch64 2022.02-3ubuntu0.22.04.4](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-qemu-efi-aarch64-2022.02-3ubuntu0.22.04.4.md) | Aug 12, 2025 |
| Linux | qemu-efi-arm Ubuntu 22.04.1 LTS (jammy) | 2022.02-3ubuntu0.22.04.4 | [qemu-efi-arm 2022.02-3ubuntu0.22.04.4](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-qemu-efi-arm-2022.02-3ubuntu0.22.04.4.md) | Aug 12, 2025 |

---

Data as of 2026-11-08T00:53:09Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.